topic whitelist directories inputs.conf in Getting Data In

whitelist directories inputs.conf

nmohammed — Tue, 29 Sep 2020 20:43:57 GMT

We've ~1000 directories in path and we want to monitor only a few selected directories. I tried to use the whitelist, voiding multiple monitoring stanzas. But it doesn't seem to work. I have verified this by running ./splunk list monitor on the forwarder. Here BX187898, BX676909 are directories in /enc_logs-ep3/bker and have log files in those directories.

Need assistance with the whitelist directories. I have tried with two directories, but I will have a few more added.

[monitor:///enc_logs-ep3/bker]
disabled = false
index = enc_logs
whitelist = (BX187898|BX676909)
host_regex = \S+(EP.*).\d{4}
sourcetype = enc
ignoreOlderThan = 3d

Thanks

Re: whitelist directories inputs.conf

somesoni2 — Mon, 06 Aug 2018 21:14:29 GMT

Can you give some sample full path of files that you want to monitor and some that you don't?

Re: whitelist directories inputs.conf

nmohammed — Mon, 06 Aug 2018 21:20:59 GMT

Thanks @somesoni2

here's a sample path path -

/enc_logs-en3/bker/BX187898/EncServer. BX187898.ENC5VEABE100934.2018-08-06-14.log

Re: whitelist directories inputs.conf

deepashri_123 — Tue, 07 Aug 2018 09:43:45 GMT

You can refer this link:
https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Whitelistorblacklistspecificincomingdata

Can you cross check your regex?
Let me know if this helps!!